externalize config, domain whitelist, source blacklist